fix(pi): restore model catalog after settings sync failure

[rsliter]

Outcome

Pi now restores the previous models.json when updating settings.json fails, or removes a catalog created by the failed attempt. Empty settings remain valid.

Reason

The generator wrote the new model catalog before reading and updating settings. A settings error could leave Pi with conflicting model defaults.

Related issues

Fixes #13362. Part of #13338.

Changes

• Snapshot the existing catalog bytes before generation. Restore them on failure, or remove a catalog that did not previously exist. Surface both errors if rollback also fails.
• Extend the existing Pi generator tests to cover an absent catalog and a previous catalog when settings parsing fails. The existing empty-settings and successful-update cases remain in the focused suite.

Verification

• npx vitest run --project integration test/agents/openclaw/runtime/pi-candidate-runtime-artifacts.test.ts — 46 tests passed. The six new rollback assertions failed before the fix.
• Installed pre-commit and pre-push hooks — passed, including repository checks, secret scan, publication validation, and CLI TypeScript check.
• npx oxfmt --check and focused npx oxlint — passed.
• Diff review found no secrets, API keys, or credentials.

Review notes

agents/pi/generate-config.ts is a sensitive runtime path. I reviewed the two-file diff at e8748aee7a8827c7ae90124b6d0f1b2891c25d49 locally; no independent pre-publication review is recorded. Fresh paired Pi image qualification receipts and exact-head CI remain pending.

---

Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code coverage overview

Languages: TypeScript

TypeScript / code-coverage/plugin

main 63002cd	codex/13362-pi-model... 573eff3	+/-
96%	97%	+1%

View coverage of the 10 most impacted files.

File	main 63002cd	codex/13362-pi-model... 573eff3	+/-
nemoclaw/src/onboard/config.ts	98%	96%	-2%
nemoclaw/src/index.ts	94%	93%	-1%
nemoclaw/src/bl...print/runner.ts	95%	95%	0%
nemoclaw/src/bl...ime-identity.ts	97%	97%	0%
nemoclaw/src/bl...t-management.ts	100%	100%	0%
nemoclaw/src/co.../config-show.ts	100%	100%	0%
nemoclaw/src/commands/slash.ts	100%	100%	0%
nemoclaw/src/ru...time-context.ts	100%	100%	0%
nemoclaw/src/sh...er-boundary.cts	100%	100%	0%
nemoclaw/src/on...native-route.ts	0%	100%	+100%

TypeScript / code-coverage/cli

main 63002cd	codex/13362-pi-model... 573eff3	+/-
84%	86%	+2%

View coverage of the 10 most impacted files.

File	main 63002cd	codex/13362-pi-model... 573eff3	+/-
src/lib/onboard.ts	62%	50%	-12%
src/lib/state/l...diness-lease.ts	66%	83%	+17%
src/lib/inferen...ollama/proxy.ts	41%	61%	+20%
src/lib/onboard.../application.ts	55%	84%	+29%
src/lib/domain/...y/dimensions.ts	0%	71%	+71%
src/lib/inferen...er/lifecycle.ts	0%	72%	+72%
src/lib/actions...ry/operation.ts	0%	76%	+76%
src/lib/actions...try/snapshot.ts	0%	78%	+78%
src/lib/inferen...ovider/index.ts	0%	88%	+88%
src/lib/onboard...ternal-image.ts	0%	91%	+91%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 17, 2026 02:44 UTC}

[github-actions]

PR Review Advisor finished for commit 7501620. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

[rsliter]

E2E evidence for exact PR commit 75016202a34b4d9a6bd77f78487d13203e0ff846 (base f1dcab784d273a56f1adc6292c7336b81fb41767). Trusted manual PR run: https://github.com/NVIDIA/NemoClaw/actions/runs/38987066533

• managed-image-multiarch-startup: passed on AMD64 and ARM64; both jobs passed isolated-registry and resource cleanup.
• full-e2e: passed the OpenClaw install, onboard, and agent-turn job.
• hermes-e2e: passed the Hermes Docker job.
• pi-agent-qualification: passed the Pi Linux AMD64 job. Its evidence records authenticated live turns before and after rebuild, credential isolation, destroy, and successful cleanup.

The Relevant E2E aggregate passed. Dispatch receipt e2e-dispatch-38987066533-1 records the same candidate SHA, all four selectors, and trusted workflow SHA 1e82499a048d5a4d85b0876d8c07bd93c8a9a5de.